Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am practicing the Astalavista Wargames and i came across this challenge. The question is: Bob wrote a piece of software but the password verification doesn't seem to work. You must find a way to log on. We were able to recover some part of the source:

typedef struct {char pass[5],valid;} password;

int main(){
    password s;
    s.valid=0;
    scanf("%s",s.pass);
    verifypass(s);
    //if password is correct the value of s.valid will change to 1
    if(s.valid==1)login();
    else printf("Wrong passwordn");
    system("Pause");
    return 0;
}

Link to original provided executable file in the question . Note that the question does not provide anything else beside this part of code and executable file.

My initial thought was that this should be done using buffer overflow attacks, so just as a common approach on my x64 machine I try to enter 1 to change the valid bit to TRUE.

when I enter this number of 1's "1111111111111111111111111111" the program allows me to enter the password again, BUT not logging in. If I enter less, it would show the wrong password and exit and if I enter more it would crash.

How can I come up with a solution to this challenge?

share|improve this question
2  
have you tried entering characters with the ASCII code 1 (char)1, not with the digit '1' (ascii 49)? –  CodesInChaos Feb 21 '13 at 15:55
1  
It is worth pointing out that a boolean value of 1 is not the same as a string value of 1, so your approach wouldn't necessarily put the right value in even if it was at the correct spot. –  AJ Henderson Feb 21 '13 at 15:57
    
You have not provided enough code to answer this question. Where is the verifypass function??? –  Rook Feb 21 '13 at 16:04
    
@Rook This is as provided in the question. The challenge is that you have only this part of code available. How can you get to pass login. –  Erfan Feb 21 '13 at 17:16
1  
@Erfan Just looking at the source, writing 49 ('1') into the valid byte would fail the ==1 test, but writing 1 would pass. –  CodesInChaos Feb 21 '13 at 18:04
show 8 more comments

1 Answer

You would be able to attack this with a buffer overflow, but it is not necessary. In order to get a buffer overflow exploit working you will need to perform dynamic analysis on the exe, using a tool such as OllyDBG. You would then run the program, passing it overlong strings until you get it to crash. The type of crash you are looking for is control over eip. Typically you would just pass a whole string of AAAAAA and check the CPU registers when the program crashes, if you see eip 0x41414141 or similar, you win and are just a few steps away from breaking the code.

However, I would attack this in a very different way. The password is stored in the exe file, but it is obfusticated - it is generated by multiplying and rotating a series of values such as 0x55555556 and 0x66666667. It then compares your password against the generated value, and branches one way or another depending on whether they match. All you need to do is subvert this branching condition. This can be achieved very easily with a hex-editor.

For a clue; the command you want to edit resides at 0x4013b3 (_main+58).

share|improve this answer
2  
It is not possible to control the EIP in this code. The Main is a special function that doesn't return. –  Rook Feb 21 '13 at 16:01
    
@Rook you could be right, I only gave it a very quick glance over in IDA, saw a small buffer, a string copy command, and a function call (verifypass) and just assumed. –  lynks Feb 21 '13 at 16:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.